Download websites that use TornadoServer

About TornadoServer

A host running TornadoServer usually says so itself, in plain words, in a header it attaches to every response it sends. A name volunteered that way is direct evidence rather than something inferred from the code a browser downloads, so confidence in this listing is higher than it would be for a client side library, and the failure mode is different too.

What the header implies is worth unpacking. Tornado is an asynchronous web framework and networking library written in Python, built for long lived connections and high concurrency rather than for rendering pages, so it turns up behind real time features: sockets held open, streaming endpoints, notification services, device and appliance interfaces, internal dashboards, and APIs that talk to something other than a browser. Seeing it answer directly on a public port also means no reverse proxy sits in front rewriting the header, which is informative in itself. Deployments of that shape tend to be small, purpose built or embedded, and less likely to carry the operational layers a large web estate would have.

Origins explain part of the pattern. The framework was written inside a startup and open sourced by Facebook (Meta) in 2009 under a Apache 2.0 licence, at a time when Python had no convincing answer to concurrent connections. The user base has been developers building services rather than owners building sites ever since, which is why the Web servers label fits it better than any content or commerce category would. As of October 2026 we detect TornadoServer on 342 sites.

Version data is where a server listing earns its keep. We see 39 distinct versions responding, and the release recorded most often is 6.1. A spread that wide within a single framework describes deployment habits rather than the software: long lived services get built, containerised and left alone, and a framework that runs quietly for years is rarely upgraded on a schedule. For a security team, a version labelled inventory of publicly reachable services is a scoping tool, because an advisory applies to a range and the range has to become a list of hosts before anyone can act on it.

The obvious limit runs the other way from the version story. Many Tornado applications sit behind a proxy or a cloud load balancer that replaces or strips the server header, and those deployments stay invisible to us no matter how heavily they are used. Our list is not an install base. Our list is the set of endpoints where the framework answers for itself, which skews toward exposed services and away from managed production estates.

The distinction is what makes the export useful rather than decorative. Checking one host tells you what one server admits to. A list of every domain where the framework responded lets a security researcher scope exposure across a version range, lets an infrastructure vendor find teams running self managed services who might buy a managed one, and lets an analyst measure how a framework ages once it has passed out of fashion but not out of production. None of those questions can be answered one hostname at a time.